Using ControlLogix in SIL2 Applications

Transcription

1 Using ControlLogix in SIL2 Applications 1756 Series Safety Reference Manual

2 Important User Information Solid state equipment has operational characteristics differing from those of electromechanical equipment. Safety Guidelines for the Application, Installation and Maintenance of Solid State Controls (Publication SGI-1.1 available from your local Rockwell Automation sales office or online at describes some important differences between solid state equipment and hard-wired electromechanical devices. Because of this difference, and also because of the wide variety of uses for solid state equipment, all persons responsible for applying this equipment must satisfy themselves that each intended application of this equipment is acceptable. In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment. The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams. No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual. Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc. is prohibited. Throughout this manual, when necessary we use notes to make you aware of safety considerations. WARNING Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss. IMPORTANT Identifies information that is critical for successful application and understanding of the product. ATTENTION Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you: identify a hazard avoid a hazard recognize the consequence SHOCK HAZARD Labels may be located on or inside the equipment (e.g., drive or motor) to alert people that dangerous voltage may be present. BURN HAZARD Labels may be located on or inside the equipment (e.g., drive or motor) to alert people that surfaces may be dangerous temperatures.

3 Summary of Changes New and Revised Information Change bars located in margins indicate updates and new information added to this revision. Table 1 lists the most significant new and revised information included in this release of this manual. Table.1 New and Revised Information Topic Location Components for Use in SIL2 Applications. Table 1.1 on Page 1-8 Checklist for the ControlLogix System. Page 2-8 Safety Certifications and Compliances Page 1-12 Probability of Failure on Demand (PFD) Table 1.2 on Page 1-14 calculations. Example PFD calculations. Table 1.4 on Page 1-19 Probability of Undetected Dangerous Table 1.3 on Page 1-17 Failure per Hour (PFH) calculations. Use of ControlNet repeaters in SIL2 Page 5-2 systems. ControlLogix Diagnostic Output Module Figure 6.7 on Page 6-10 Wiring. ControlLogix Standard Output Wiring Figure 6.8on Page 6-11 General Considerations for the use of Page 6-20 analog modules. ControlLogix Analog Module Wiring in Figure 6.18 on Page 6-24 Current Mode. Security considerations for programming. Page 8-4 Spurious Failure Estimates Page D-1 Sample Probablity of Failure on Demand Page E-1 (PFD) Calculations Probablity of Failure on Demand (PFD) Page F-2 Calculations in a SIL1 Application Probability of Undetected Dangerous Page F-4 Failure Per Hour (PFH) Calculations in SIL1 Applications iii

4 Summary of Changes iv Notes:

5 Preface Introduction This application manual is intended to describe the ControlLogix Control System components available from Rockwell Automation that are suitable for use in SIL2 applications. IMPORTANT This manual describes typical SIL2 implementations using certified ControlLogix equipment. Keep in mind that the descriptions presented in this manual do not preclude other methods of implementing a SIL2-compliant system using ControlLogix. Other methods may include TUV-approved application-certified architectures, or the use of the FLEX I/O system as described in FLEX I/O System with ControlLogix for SIL2 reference manual, publication 1794-RM001. Manual Set-Up2006 This manual is designed to make clear how the ControlLogix Control System can be SIL2-certified. Table Preface.1 lists the information available in each section. Table Preface.1 If you need this information: Introduction to the SIL policy and how that policy relates to the ControlLogix system, including: typical SIL2 configurations both non-redundant and redundant proof test descriptions complete list of SIL2-certified ControlLogix components probability of failure on demand (PFD) and probability of dangerous failure occurring per hour (PFH) calculations for SIL2-certified components with a 1 year proof test interval Brief overview of all the components present in the SIL2-certified ControlLogix system, including: fault reporting fault handling module diagnostics checklist for a SIL2-certified ControlLogix system Description of the ControlLogix power supplies and chassis used in a SIL2-certified ControlLogix system and recommendations on using these components. Description of the ControlLogix controllers used in the SIL2-certified ControlLogix system, including the 1784-CG64 CompactFlash card and recommendations on using the controllers. Description of the ControlLogix communications modules used in the SIL2-certified ControlLogix system and recommendations on their use in SIL2-certified system. See this section: Chapter 1, SIL Policy Chapter 2, The ControlLogix System Chapter 3, ControlLogix System Hardware Chapter 4, ControlLogix Controller Chapter 5, ControlLogix Communications Modules v

6 Preface vi Table Preface.1 If you need this information: Description of the ControlLogix I/O modules used in the SIL2-certified ControlLogix system, including: use of both digital and analog I/O modules I/O module fault reporting usage considerations wiring diagrams checklist for I/O modules in a SIL2-certified ControlLogix system Description of how the ControlLogix detects, and reacts to, faults. Specifically, this section describes the following two example conditions that generate a fault in a SIL2-certified system: keyswitch changing out of RUN mode high alarm condition on an analog input module Guidelines for application development in RSLogix 5000 as they relate to SIL2-certified systems. The guidelines include: suggestions of good design practices checking the application program identifying the program forcing security checklist for the creation of an application program Description of technical safety requirement in SIL2-certified ControlLogix applications. The following topics are described in this section: general programming procedures SIL task/program instructions available programming languages commissioning lifecycle method to change an application program forcing Description of the precautions and techniques that should be used with HMI devices as they are used in SIL2-certified ControlLogix applications, including: information about changing parameters in a safety-related loop information about changing parameters in a non-safety-related loop Calculation methods for worst case reaction time for a given change in input or a fault condition and the corresponding output action. Self-testing in a ControlLogix system and more information about user-programmed responses. Additional information on handling faults. See this section: Chapter 6, ControlLogix I/O Modules Chapter 7, Faults in the ControlLogix System Chapter 8, General Requirements for Application Software Chapter 9, Technical SIL2 Requirements for the Application Program Chapter 10, Use and Application of Human to Machine Interfaces Appendix A, Response Times in ControlLogix Appendix B, System Self-Testing and User-Programmed Responses Appendix C, Additional Information on Handling Faults in the ControlLogix System

7 Preface vii Table Preface.1 If you need this information: Spurious failure rates based on field returns. Additional PFD calculations based on proof test intervals of 2 years and 4 years. Using ControlLogix in SIL1 applications See this section: Appendix D, Spurious Failure Estimates Appendix E, Sample Probability of Failure on Demand (PFD) Calculations Appendix F, Using ControlLogix in SIL1 Applications Understanding Terminology The following table defines acronyms used in this manual. Table Preface.2 List of Acronyms Used Throughout the Safety Application Manual Acronym: Full Term: Definition: CIP Control and Information Protocol A messaging protocol used by Logix5000 systems. It is a native communications protocol used on ControlNet communications networks, among others. DC Diagnostic Coverage The ratio of the detected failure rate to the total failure rate. EN European Norm. The official European Standard GSV Get System Value A ladder logic output instruction that retrieves specified controller status information and places it in a destination tag. MTBF Mean Time Average time between failure occurrences. Between Failures MTTR Mean Time to Restoration Average time needed to restore normal operation after a failure has occurred. PADT PC PFD PFH Programming and Debugging Tool Personal Computer Probability of Failure on Demand Probability of Failure per Hour RSLogix 5000 software used to program and debug a SIL2-certified ControlLogix application. Computer used to interface with, and control, a ControlLogix system via RSLogix 5000 programming software. The average probability of a system to fail to perform its design function on demand. The probability of a system to have a dangerous failure occur per hour.

8 Preface viii Notes:

9 Table of Contents Chapter 1 SIL Policy Introduction to SIL Typical SIL2 Configurations Proof Tests Prooftesting with Redundancy Systems SIL2-Certified ControlLogix System Components Safety Certifications and Compliances Hardware Designs and Firmware Functions Difference Between PFD and PFH SIL Compliance Distribution and Weight Other Agency Certifications Response Times Response Times in Redundancy Systems Program Watchdog Time in ControlLogix System Contact Information When Device Failure Occurs Chapter 2 The ControlLogix System General Overview of ControlLogix Platform Overview of the ControlLogix Architecture Module Fault Reporting Fault Handling Data Echo Communication Check Pulse Test Software Communications Other Unique Features that Aid Diagnostics Checklist for the ControlLogix System Chapter 3 ControlLogix System Hardware Introduction to the Hardware ControlLogix Chassis ControlLogix Power Supplies Non-Redundant Power Supply Redundant Power Supply Recommendations for System Hardware Use Chassis Power Supplies Related ControlLogix Hardware Documentation Chapter 4 ControlLogix Controller Introduction to the Controller CompactFlash Card Recommendations for Controller Use Related Controller Documentation ix

10 Table of Contents x ControlLogix Communications Modules Chapter 5 Introduction to Communication Modules ControlNet Bridge Module ControlNet Cabling ControlNet Repeater ControlNet Module Diagnostic Coverage Ethernet Module Ethernet Versus ControlNet Data Highway Plus - Remote I/O SynchLink Recommendations for Communications Modules Use Related Communications Modules Documentation Chapter 6 ControlLogix I/O Modules Overview of ControlLogix I/O Modules Module Fault Reporting for any ControlLogix I/O Module Using Digital Input Modules General Considerations when using Any ControlLogix Digital Input Module Wiring ControlLogix Digital Input Modules Using Digital Output Modules General Considerations when using Any ControlLogix Digital Output Module Wiring ControlLogix Digital Output Modules Diagnostic Digital Output Modules Standard Digital Output Modules Using Analog Input Modules General Considerations when using Any ControlLogix Analog Input Module Wiring ControlLogix Analog Input Modules Wiring the Single-Ended Input Module in Voltage Mode 6-16 Wiring the Single-Ended Input Module in Current Mode 6-17 Wiring the Thermocouple Input Module Wiring the RTD Input Module Using Analog Output Modules General Considerations when using Any ControlLogix Analog Output Module Wiring ControlLogix Analog Output Modules Wiring the Analog Output Module in Voltage Mode Wiring the Analog Output Module in Current Mode Checklist for SIL Inputs Checklist for SIL Outputs

11 Table of Contents xi Chapter 7 Faults in the ControlLogix System Introduction Checking Keyswitch Position with GSV Instruction Examining an Analog Input Module s High Alarm General Requirements for Application Software Technical SIL2 Requirements for the Application Program Use and Application of Human to Machine Interfaces Chapter 8 Software for SIL2-Related Systems SIL2 Programming Safety Concept of the ControlLogix system General Guidelines for Application Software Development. 8-2 Check the Created Application Program Possibilities of Program Identification Forcing Security ControlLogix System Operational Modes Checklist for the Creation of an Application Program Chapter 9 General Procedure Basics of Programming Logic and Instructions 2 Program Logic 2 Specification 3 Sensors (Digital or Analog) 3 Actuators 4 SIL Task/Program Instructions Programming Languages Commissioning Life Cycle Changing Your Application Program Forcing Chapter 10 Using Precautions and Techniques with HMI Accessing Safety-Related Systems Changing Parameters in Safety-Related Systems Changing Parameters in Non-Safety-Related Systems

12 Table of Contents xii Appendix A Response Times in ControlLogix Digital Modules A-1 Local Chassis Configuration A-1 Remote Chassis Configuration A-2 Analog Modules A-3 Local Chassis Configuration A-3 Remote Chassis Configuration A-3 Redundancy Systems A-5 System Self-Testing and User-Programmed Responses Appendix B Validation Tests B-1 System Self Tests B-1 Reaction to Faults 2 Additional Information on Handling Faults in the ControlLogix System Appendix C Introduction C-1 Appendix D Spurious Failure Estimates Introduction D-1 Sample Probability of Failure on Demand (PFD) Calculations Using ControlLogix in SIL1 Applications Appendix E Proof Test Interval = 5 Years E-1 Appendix F Additional Considerations F-1 Probability of Failure on Demand Calculations in a SIL1 Application F-2 Probability of Undetected Dangerous Failure Per Hour Calculations in a SIL1 Application F-4

13 Chapter 1 SIL Policy This chapter introduces you to the SIL policy and how the ControlLogix system meets the requirements for SIL2 certification. For information about: See page: Introduction to SIL 1-1 Typical SIL2 Configurations 1-4 Proof Tests 1-6 SIL2-Certified ControlLogix System Components 1-8 Safety Certifications and Compliances 1-12 Hardware Designs and Firmware Functions 1-12 Difference Between PFD and PFH 1-12 ControlLogix Product Probability of Failure on 1-14 Demand (PFD) Calculations ControlLogix Product Probability of Undetected 1-17 Dangerous Failure per Hour (PFH) Calculations SIL Compliance Distribution and Weight 1-20 Other Agency Certifications 1-21 Response Times 1-21 Program Watchdog Time in ControlLogix System 1-23 Contact Information When Device Failure Occurs 1-23 Introduction to SIL Certain catalog numbers (listed in Table 1.1 on page 1-8) of the ControlLogix system are type-approved and certified for use in SIL2 applications according to IEC 61508, and RC4 applications are certified according to DIN V Approval requirements are based on the standards current at the time of certification. These requirements consist of mean time between failures (MTBF), probability of failure, failure rates, diagnostic coverage and safe failure fractions that fulfill SIL2 and AK4 criteria. The results make the ControlLogix system suitable up to, and including, SIL2 and AK4. When the ControlLogix system is in the maintenance or programming mode, the user is responsible for maintaining a safe state. For support in creation of programs, the PADT (Programming and Debugging Tool) is required. The PADT for ControlLogix is RSLogix 5000, per IEC , and this Safety Reference Manual. 1

14 1-2 SIL Policy The TUV Rheinland Group has approved the ControlLogix system for use in up to, and including, SIL 2 safety related applications in which the de-energized state is typically considered to be the safe state. All of the examples related to I/O included in this manual are based on achieving de-energization as the safe state for typical Emergency Shutdown (ESD) Systems. ControlLogix is a modular and configurable system with the ability to pre-configure outputs and other responses to fault conditions. As such, a system can be designed to meet requirements for hold last state" in the event of a fault so that the system can be used in up to, and including, SIL 2 level Fire and Gas and other Applications that require that output signals to actuators remain on. By understanding the behavior of the ControlLogix system for an emergency shutdown application, the system design can incorporate appropriate measures to meet other application requirements. These measures relate to the control of outputs and actuators which must remain on to be in a safe state. The other requirements for SIL2 regarding inputs from sensors, software etc. must also be met. The measures and modifications which relate to Gas and Fire are listed below. The use of a manual over-ride is necessary to ensure the operator can maintain the desired control in the event of a Controller Failure. This is similar in concept to the function of the external relay or redundant outputs required to ensure a de-energized state is achieved for an ESD system should a failure occur (e.g., such as a shorted output driver) that would prevent this from normally occurring. The system knows it has a failure but the failure mode requires an independent means to maintain control and either remove power or provide an alternate path to maintain power to the end actuator. If the application cannot tolerate an output that can fail shorted (energized) then an external means such as a relay or other output must be wired in series to remove power when the fail shorted condition occurs. (Refer to Figure 6.8 on page 6-11) If the application cannot tolerate an output that fails open (deenergized) then an external means such as a manual override or output must be wired in parallel. (Refer to the manual override Figure 1.1 on page 1-3). The user must supply the alternative means and develop the application program to initiate the alternate means of removing or continuing to supply power in the event the main output fails.

15 SIL Policy 1-3 This manual over-ride circuit is shown in Figure 1.1. It is composed of a hardwired set of contacts from a selector switch or push-button. One Normally Open contact provides for the bypass of power from the Controller output directly to the actuator. The other is a Normally closed contact to remove or isolate the controller output An application program needs to be generated to monitor the diagnostic output modules for dangerous failures such as shorted or open output driver channels. Diagnostic output modules must be configured to hold last state in the event of a fault. A diagnostic alarm must be generated to inform the operator that manual control is required. The faulted module must be replaced within a reasonable time frame. Any time a fault is detected the user must annunciate the fault to an operator by some means (for example, an alarm light). Figure 1.1 L1 Manual Override Actuator L2 or Ground Fault Alarm to Operator

16 1-4 SIL Policy Typical SIL2 Configurations SIL2-certified ControlLogix systems can be used in a non-redundancy or redundancy configuration. The most significant difference between these configurations is that the redundancy configuration uses an identical pair of ControlLogix chassis to keep your machine or process running if a problem occurs with a controller. Figure 1.2 shows a typical SIL loop that does not use redundancy, including: the overall safety loop the ControlLogix portion of the overall safety loop how other devices (for example, HMI) connect to the loop, while operating outside the loop This loop is used for fail safe applications. Figure 1.2 Typical SIL Loop Without Controller Redundancy Programming Software For SIL applications, a programming terminal is not normally connected. HMI For Diagnostics and Visualization (read-only access to controllers in the safety loop). For more information, see Chapter 10. Plant-wide Ethernet/Serial Overall Safety Loop SIL2-certified ControlLogix components portion of the overall safety loop Sensor E N B T C N B C N B I/O C N B Actuator ControlNet To other safety related ControlLogix and remote I/O chassis ControlNet To non-safety related systems outside the ControlLogix portion of the SIL2-certified loop. For more information, see Chapter 5.

17 SIL Policy 1-5 Figure 1.3 shows a typical SIL loop that uses redundancy, including: the overall safety loop the ControlLogix portion of the overall safety loop how other devices (for example, HMI) connect to the loop, while operating outside the loop IMPORTANT With regard to IEC 61508, most SIL2-certified systems are fault tolerant for the entire system. However, the ControlLogix system is fault tolerant only for the devices in the primary/secondary chassis and not the entire system. This loop is used for high availability applications. Figure 1.3 Typical SIL Loop With Controller Redundancy Programming Software For SIL applications, a programming terminal is not normally connected. HMI For Diagnostics and Visualization (read-only access to controllers in the safety loop). For more information, see Chapter 10. Plant-wide Ethernet/Serial Overall Safety Loop SIL2-certified ControlLogix components portion of the overall safety loop Primary chassis Remote I/O chassis Sensor E N B T C N B C N B S R M I/O C N B Actuator ControlNet Secondary chassis E N B T C N B C N B S R M To other safety related ControlLogix and remote I/O chassis ControlNet To non-safety related systems outside the ControlLogix portion of the SIL2-certified loop. For more information, see Chapter 5.

18 1-6 SIL Policy IMPORTANT The system user is responsible for: the set-up, SIL rating and validation of any sensors or actuators connected to the ControlLogix control system. project management and functional testing. programming the application software and the module configuration according to the description in the following chapters. The SIL2 portion of the certified system excludes the development tools and display/human machine interface (HMI) devices; these tools and devices are not part of the run time control loop. It is also important to note that ControlLogix SIL2 certification is only available on ControlLogix Redundancy systems that use 1756-L55M13 and 1756-L55M16 controllers. While you can use the 1756-L6x controllers in a redundant ControlLogix system, this set-up has not yet been SIL2-certified. Proof Tests IEC requires the user to perform various proof tests of the equipment used in the system. Proof tests are performed at user-defined times (for example, proof test intervals can be once a year, once every two years or whatever timeframe is appropriate) and include some of the following tests: Testing of all fault routines to verify that process parameters are monitored properly and the system reacts properly when a fault condition arises. Testing of digital input or output channels to verify that they are not stuck in the ON or OFF state. Calibration of analog input and output modules to verify that accurate data is obtained from and used on the modules.

19 SIL Policy 1-7 IMPORTANT Users specific applications will determine the timeframe for the proof test interval. However, keep in mind that the Probability of Failure on Demand (PFD) calculations listed in Table 1.2 on page 1-14 use a proof test interval of once per year. If the proof test interval is not once per year, the information must be recalculated. For sample PFD calculations for proof test intervals of 2 and 4 years, see Appendix E Prooftesting with Redundancy Systems A ControlLogix redundancy system uses an identical pair of ControlLogix chassis to keep your machine or process running if a problem occurs with those chassis. When a failure occurs in any of the components of the primary chassis, control switches to the secondary controller. The switchover can be monitored so that the system notifies the user when it has occurred. In this case (i.e., when a switchover takes place), we recommend that you replace the failed controller with the mean time to restoration (MTTR) for your application. If you are using controller redundancy in a SIL2 application, you must perform half the proof test on the primary controller and half the proof test on the secondary controller. TIP If you are concerned about the availability of the secondary controller if the primary controller fails, it is good engineering practice to implement a switchover periodically (e.g., once per proof test interval). For more information on switchovers in ControlLogix redundancy systems and ControlLogix redundancy systems in general, see the ControlLogix Redundancy System user manual, publication 1756-UM523. For more information on system proof tests, see Chapter 2, The ControlLogix System. For more information on the necessary I/O module proof tests, see Chapter 6, ControlLogix I/O Modules.

20 1-8 SIL Policy SIL2-Certified ControlLogix System Components Table 1.1 lists the components available for use in a SIL2-certified ControlLogix system. Table 1.1 Components For Use in the SIL 2 System Device Type: Catalog Number: Hardware 1756-A4, A7, A10, A13 & A17 Controllers Used in Non- Redundant Applications Description: Series: Firmware Revision (7),(8) : Related Documentation (9) : Installation Instructions: User Manual: ControlLogix Chassis B NA 1756-IN080 None available for these catalog numbers 1756-PA75 AC Power supply A NA PB75 DC Power supply A NA 1756-PA75 AC Power supply B NA 1756-IN PB75 DC Power supply B NA 1756-PA75R AC Redundant power supply A NA 1756-IN PB75R DC Redundant power supply A NA 1756-PC75 DC Power supply B NA 1756-IN PH75 DC Power supply B NA 1756-IN PSCA (1) Redundant Power Supply A NA 1756-IN574 Chassis Adapter Module 1756-PSCA2 Redundant Power Supply Chassis Adapter Module 1756-L55M13 ControlLogix 1.5 Mb Controller A L55M16 ControlLogix 7.5 Mb Controller A L61 (2) ControlLogix 2 Mb Controller B L62 (2) ControlLogix 4 Mb Controller B L63 (2) ControlLogix 8 Mb Controller B A NA 1756-IN IN UM001

21 SIL Policy 1-9 Table 1.1 Components For Use in the SIL 2 System Device Type: I/O Modules - Digital Catalog Number: Description: Series: 1756-IA16I AC Isolated Input Module A IN UM IA8D AC Diagnostic Input Module A IN IB16D DC Diagnostic Input Module A IN IB16I DC Isolated Input Module A IN IB16ISOE Sequence of Events Module A IN UM IB32 DC Input Module B IN UM IH16ISOE Sequence of Events Module A IN UM OA16I AC Isolated Output Module A IN UM OA8D AC Diagnostic Input Module A IN OB16D DC Diagnostic Output Module A OB16I DC Isolated Output Module A OB32 DC Output Module A OB8EI DC Isolated Output Module A OW16I Isolated Relay Output Module A OX8I Isolated Relay Output Module A Firmware Revision (7),(8) : Related Documentation (9) : Installation Instructions: 1756-IN IN IN IN IN IN513 User Manual:

22 1-10 SIL Policy Table 1.1 Components For Use in the SIL 2 System Device Type: I/O Modules - Analog Communication Modules Catalog Number: 1756-IF16 Single-ended Analog A IN UM009 Input Module 1756-IF6CIS Isolated Sourcing Analog A IN579 Input Module 1756-IF6I Isolated Analog Input Module A IN IF8 Analog Input Module A IN IR6I RTD Input Module A IN IT6I Thermocouple Input Module A IN IT6I OF6CI 1756-OF6VI Enhanced Thermocouple Input Module Isolated Analog Output Module (Current) Isolated Analog Output Module (Voltage) A A A IN IN IN OF8 Analog Output Module A IN CNB (3) 1756-CNBR 1756-CNB 1756-CNBR 1756-DHRIO (4) 1756-ENBT (5) Description: ControlNet Communication Module Redundant ControlNet Communication Module ControlNet Communication Communication Module Redundant ControlNet Communication Module Data Highway Plus - Remote I/O Communication Interface Module EtherNet Communication Module Series: D D IN571 E IN604 E 11.2 CNET-UM001 C IN UM514 A Firmware Revision (7),(8) : Related Documentation (9) : Installation Instructions: 1756-IN019 User Manual: 1756-UM SYNCH (6) SynchLink Module A IN UM521

23 SIL Policy 1-11 Table 1.1 Components For Use in the SIL 2 System Device Type: Redundancy Controllers and Modules Catalog Number: 1756-L55M13 ControlLogix 1.5 Mb Controller A L55M16 ControlLogix 7.5 Mb Controller A L61 ControlLogix 2 Mb Controller B L62 ControlLogix 4 Mb Controller B L63 ControlLogix 8 Mb Controller B SRM System Redundancy Module B CNB (3) 1756-CNBR 1756-CNB (3) 1756-CNBR 1756-ENBT Description: ControlNet Communication Module Redundant ControlNet Communication Module ControlNet Communication Module Redundant ControlNet Communication Module EtherNet Communication Module Series: D D IN IN IN571 E IN604 E 11.2 A Firmware Revision (7),(8) : Related Documentation (9) : Installation Instructions: 1756-IN019 User Manual: 1756-UM UM523 CNET-UM UM050 (1) Existing systems that use the 1756-PSCA are SIL2-certified. However, when implementing new SIL2-certified systems or upgrading existing systems, we recommend that you use the 1756-PSCA2 if possible. (2) Use of any 1756-L6x/B controller requires the use of the Series B versions of the 1756-Px75 power supplies. (3) Specified ControlNet repeaters may be used in SIL2 applications. See Chapter 5 for more information. (4) The 1756-DHRIO module is included in this table because this module can be used to connect the safety system to the Data Highway Plus network. However, the Data Highway Plus network is not SIL2-certified and cannot be used as part of the SIL2-certified system. It can only be used to connect non-safety devices to the safety system. Because the module is not part of the safety system, it is not listed in PFD and PFH calculations in Table 1.2 and Table 1.3 later in this chapter. (5) The 1756-ENBT module is included in this table because this module can be used to connect the safety system to the EtherNet/IP network However, the EtherNet/IP network is not SIL2-certified and cannot be used as part of the SIL2-certified system. It can only be used to connect non-safety devices to the safety system. Because the module is not part of the safety system, it is not listed in PFD and PFH calculations in Table 1.2 and Table 1.3 later in this chapter. (6) The 1756-SYNCH module is included in this table because this module can be used to propagate time between chassis and to record events that occur in each chassis. Because this module is not used for any safety-related activities, it is not listed in PFD and PFH calculations in Table 1.2 and Table 1.3 later in this chapter. (7) Catalog numbers that list multiple firmware revisions have multiple revisions that are SIL2-certified. When implementing new SIL2-certified systems or upgrading existing SIL2-certified systems, we recommend that you use the latest certified firmware revision (that is, the higher number). However, systems that continue to use the older firmware revision remain SIL2-certified. (8) Users must use these series and firmware revisions for their application to be SIL2 certified. Firmware revisions are available by visiting (9) These publications are available from Rockwell Automation by visiting

24 1-12 SIL Policy Safety Certifications and Compliances Hardware Designs and Firmware Functions ControlLogix products referenced in this manual may have safety certifications in addition to the TUV SIL. To view addtional safety certifications for products, go to and select the Product Certifications link. Diagnostic hardware designs and firmware functions designed into the ControlLogix platform allow it to achieve at least SIL2 certification in a single-controller configuration. These diagnostic features are incorporated into specific ControlLogix components, such as the: processor power supply I/O modules backplane and are covered in subsequent sections. The ControlLogix platform s designs, features and characteristics make it one of the most intelligent platforms. Some of the ControlLogix features include: multiple microprocessors that check themselves and each other I/O modules with internal microprocessors an I/O architecture that includes modules with backplane connections to the main central processing unit (CPU). The backplane connections, along with configuration identities, permit a new level of I/O module diagnostics unavailable in earlier platforms. Difference Between PFD and PFH Safety-related systems can be classified as operating in either a low demand mode, or in a high demand/continuous mode. IEC quantifies this classification by stating that the frequency of demands for operation of the safety system is no greater than once per year in the low demand mode, or greater than once per year in high demand/continuous mode. Generally speaking however, the once per year is expanded to ten times per year. Probability of failure on demand (PFD) is the SIL value for a low demand safety-related system as related directly to order-of-magnitude ranges of its average probability of failure to satisfactorily perform its safety function on demand. The probability of dangerous failure occurring per hour (PFH) is directly related to the SIL value for a high demand/continuous mode safety-related system.

25 SIL Policy 1-13 Although PFD and PFH values are usually associated with each of the three elements making up a safety-related system (the sensors, the actuators, the logic element), they can be associated with each component of the logic element, that is, each module of a Programmable Controller. Table 1.2 and Table 1.3 present values of the PFDs and PFHs for the specific ControlLogix products evaluated by TUV. The Mean Time Between Failure (MTBF) values listed in Table 1.2 and Table 1.3 are calculated from field data for each product. A minimum installed base must exist for at least one year before a value is calculated. It is assumed that the products are in use 16 hours/day, 5 days/week, 52 weeks/year. The Failure Rate (λ) column of Table 1.2 and Table 1.3 is just the reciprocal of MTBF. For the example PFD calculations, several assumptions were made: 50% of the failures of each product reported to Rockwell Automation are dangerous failures. The diagnostic coverage (DC) is 90% for modules used in a 1oo1 architecture. The diagnostic coverage is 60% for modules used in a 1oo2 architecture. The fraction of detected common cause failures (β D ) is 1%. The fraction of undetected common cause failures (β) is 2% Because Rockwell Automation does not and can not know every potential application for each product, these very conservative assumptions had to be made to do the calculations. For the sample calculations presented in this manual, the following values were used as the two application-dependent variables: The Mean Time to Restoration (MTTR) is ten hours. The Proof Test Interval (T 1 ) is one year (8760 hours). (1) The equation for PFD, from IEC61508, for a 1oo1 architecture is: PFD = (λ DU + λ DD )t CE = λ D t CE = λ/2 [T 1 /2 (1 - DC) + MTTR] (1) For PFD calculations using proof test intervals of 2 and 4 years, see Appendix E.

26 1-14 SIL Policy where: λ DU is the undetected dangerous failure rate (per hour) λ DD is the detected dangerous failure rate (per hour) t CE is the "channel equivalent mean down time" λ D is the dangerous failure rate (per hour) λ is the overall product failure rate (per hour) For a 1oo2 architecture, the PFD equation is much more complex. See IEC61508 Part 6 Annex B. The PFD values in Table 1.2 are given for the architecture that must be used for specific products to achieve SIL 2. Table 1.3 includes the same MTBF and Failure Rate values as Table 1.2 but adds calculated PFH values for high demand/continuous mode operation. The equation for PFH, from IEC61508, for a 1oo1 architecture is: PFH = λ DU = λ/2 (1 - DC) For a 1oo2 architecture, see Part 6 of IEC The values in Table 1.2 are given for the architecture that must be used for specific products to achieve SIL2. Table 1.2 ControlLogix Product Probability of Failure on Demand (PFD) Calculations Catalog Number Description Mean Time Between Failure (MTBF) (1) λ (6) Calculated PFD: 1oo1 architecture 1oo2 architecture 1756-Axx ControlLogix Chassis 36,322,045 (2) 2.75E E E CNB/D ControlNet Bridge - Series D 5,595, E E E CNB/E ControlNet Bridge - Series E 2,944,988 (3) 3.40E E E CNBR/D Redundant ControlNet Bridge - Series D 3,109, E E E CNBR/E Redundant ControlNet Bridge - 2,864,755 (4) 3.49E E E-06 Series E 1756-IA16I AC Isolated Input 15,262, E E E IA8D AC Diagnostic Input 10,383, E E E IB16D DC Diagnostic Input 41,300, E E E IB16I DC Isolated Input 19,862, E E E IB16ISOE Sequence of Events Module 4,959,088 (5) 2.02E E E IB32 DC Input Module 2,468, E E E IF8 Single-ended Analog Input Module 2,235, E E E IF16 Isolated Sourcing Analog Input Module 2,094, E E E-06

27 SIL Policy 1-15 Table 1.2 ControlLogix Product Probability of Failure on Demand (PFD) Calculations Catalog Number Description Mean Time Between Failure (MTBF) (1) 1756-IF6CIS Isolated Analog Input Module 3,065, E E E IF6I Analog Input 2,838, E E E IH16ISOE Sequence of Events Module 6,044,122 (5) 1.65E E E IR6I RTD Input 3,826, E E E IT6I Thermocouple Input 3,002, E E E IT6I2 Enhanced Thermocouple Input 991, E E E-05 Module 1756-L55M13 ControlLogix 1.5Mb Controller 2,228, E E E L55M16 ControlLogix 7.5Mb Controller 1,644, E E E L61 ControlLogix 2 Mb Controller 815, E E E L62 ControlLogix 4 Mb Controller 576, E E E L63 ControlLogix 8 Mb Controller 782, E E E OA16I AC Isolated Output 10,911, E E E OA8D AC Diagnostic Output 6,922, E E E OB16D DC Diagnostic Output 14,321, E E E OB16I DC Isolated Output 2,371, E E E OB32 DC Output Module 1,278, E E E OB8EI DC Fused Output 5,853, E E E OF6CI Isolated Analog Output Module 9,296, E E E-06 (Current) 1756-OF6VI Isolated Analog Output Module 13,062, E E E-06 (Voltage) 1756-OF8 Analog Output 5,717, E E E OW16I Isolated Relay Output Module 1,360,415 (5) 7.35E E E OX8I Contact Output 19,281, E E E PA75/A AC Power Supply 14,538, E E E PA75/B AC Power Supply 5,513,591 (5) 1.81E E E PA75R AC Redundant Power Supply 296,978 (4) 3.37E E E PB75/A DC Power Supply 10,157, E E E PB75/B DC Power Supply 5,884,430 (5) 1.70E E E PB75R DC Redundant Power Supply 1,134,848 (4) 8.81E E E PC75 DC Power supply 5,894,836 (5) 1.70E E E PH75 DC Power supply 5,889,628 (5) 1.70E E E-06 λ (6) Calculated PFD: 1oo1 architecture 1oo2 architecture

28 1-16 SIL Policy Table 1.2 ControlLogix Product Probability of Failure on Demand (PFD) Calculations Catalog Number Description Mean Time Between Failure (MTBF) (1) 1756-PSCA Power Supply Chassis Adapter 45,146,727 (5) 2.21E E E-07 Module 1756-PSCA2 Redundant Power Supply Chassis 45,146,727 (5) 2.21E E E-07 Adapter Module 1757-SRM System Redundancy Module 835, E E E-05 (1) MTBF measured in hours. The values used here represent values available in September (2) Aggregate based on total shipments and total returns of all five chassis (1756-A4, 1756-A7, 1756-A10, 1756-A13, and 1756-A17) collectively. λ (6) Calculated PFD: 1oo1 architecture 1oo2 architecture (3) (4) Calculated using field-based values for components. Calculated using field-based values for components. (5) Calculated using field-based values for components. (6) λ = Failure Rate = 1/MTBF. For PFD calculations with proof test interval of 5 years, see Appendix E.

29 SIL Policy 1-17 Table 1.3 ControlLogix Product Probability of Undetected Dangerous Failure per Hour (PFH) Calculations Catalog Number Description Mean Time Between Failure (MTBF) (1) λ (5) Calculated PFH: 1oo1 architecture 1oo2 architecture 1756-Axx ControlLogix Chassis 36,322,045 (2) 2.75E E E CNB/D ControlNet Bridge - Series D 5,595, E E E CNB/E ControlNet Bridge - Series E 2,944,988 (3) 3.40E E E CNBR/D Redundant ControlNet Bridge - Series D 3,109, E E E CNBR/E Redundant ControlNet Bridge - 2,864,755 (5) 3.49E E E-09 Series E 1756-IA16I AC Isolated Input 15,262, E E E IA8D AC Diagnostic Input 10,383, E E E IB16D DC Diagnostic Input 41,300, E E E IB16I DC Isolated Input 19,862, E E E IB16ISOE Sequence of Events Module 4,959,088 (5) 2.02E E E IB32 DC Input Module 2,468, E E E IF8 Single-ended Analog Input Module 2,235, E E E IF16 Isolated Sourcing Analog Input 2,094, E E E-09 Module 1756-IF6CIS Isolated Analog Input Module 3,065, E E E IF6I Analog Input 2,838, E E E IH16ISOE Sequence of Events Module 6,044,122 (5) 1.65E E E IR6I RTD Input 3,826, E E E IT6I Thermocouple Input 3,002, E E E IT6I2 Enhanced Thermocouple Input 991, E E E-09 Module 1756-L55M13 ControlLogix 1.5Mb Controller 2,228, E E E L55M16 ControlLogix 7.5Mb Controller 1,644, E E E L61 ControlLogix 2 Mb Controller 815, E E E L62 ControlLogix 4 Mb Controller 576, E E E L63 ControlLogix 8 Mb Controller 782, E E E OA16I AC Isolated Output 10,911, E E E OA8D AC Diagnostic Output 6,922, E E E OB16D DC Diagnostic Output 14,321, E E E OB16I DC Isolated Output 2,371, E E E OB32 DC Output Module 1,278, E E E OB8EI DC Fused Output 5,853, E E E-09

30 1-18 SIL Policy Table 1.3 ControlLogix Product Probability of Undetected Dangerous Failure per Hour (PFH) Calculations Catalog Number Description 1756-OF6CI Isolated Analog Output Module 9,296, E E E-10 (Current) 1756-OF6VI Isolated Analog Output Module 13,062, E E E-10 (Voltage) 1756-OF8 Analog Output 5,717, E E E OW16I Isolated Relay Output Module 1,360,415 (5) 7.35E E E OX8I Contact Output 19,281, E E E PA75/A AC Power Supply 14,538, E E E PA75/B AC Power Supply 5,513,591 (5) 1.81E E E PA75R AC Redundant Power Supply 296,978 (4) 3.37E E E PB75/A DC Power Supply 10,157, E E E PB75/B DC Power Supply 5,884,430 (5) 1.70E E E PB75R DC Redundant Power Supply 1,134,848 (4) 8.81E E E PC75 DC Power supply 5,894,836 (5) 1.70E E E PH75 DC Power supply 5,889,628 (5) 1.70E E E PSCA Power Supply Chassis Adapter 45,146,727 (5) 2.21E E E-10 Module 1756-PSCA2 Redundant Power Supply Chassis 45,146,727 (5) 2.21E E E-10 Adapter Module 1757-SRM System Redundancy Module 835, E E E-09 (1) MTBF measured in hours. The values used here represent values available in September (2) Aggregate based on total shipments and total returns of all five chassis (1756-A4, 1756-A7, 1756-A10, 1756-A13, and 1756-A17) collectively. (3) Calculated using field-based values for components. Mean Time Between Failure (MTBF) (1) λ (5) Calculated PFH: 1oo1 architecture 1oo2 architecture (4) Assumes that both power supplies fail simultaneously. (5) λ = Failure Rate = 1/MTBF

31 SIL Policy 1-19 Table 1.4 shows an example of a PFD calculation for a fail-safe configuration involving two DC input modules used in a 1oo2 configuration and a DC output module.the exaple calculation is depicted in the first loop shown in Figure 1.4 on page Table 1.4 Catalog Number: Description: MTBF: Calculated PFD: 1756-Axx 1756-L55M16 ControlLogix Chassis ControlLogix 5555 Controller 36,322, E-06 1,644, E OB16D DC Output 14,321, E IB16D DC Diagnostic Input 41,300, E-07 Total PFD calculation for a safety loop consisting of these products: 1.58E-04

32 1-20 SIL Policy SIL Compliance Distribution and Weight The programmable controller may conservatively be assumed to contribute 10% of the reliability burden. (See Figure 1.4.) A SIL 2 system may need to incorporate multiple inputs for critical sensors and input devices, as well as dual outputs connected in series to dual actuators dependent on SIL assessments for the safety related system. (See Figure 1.4) Figure 1.4 ControlLogix Systems or Loop +V 10% of the PFD 40% of the PFD Sensor Input Module Power Supply Controller Diag. Output Module Actuator 50% of the PFD Sensor Input Module V 10% of the PFD 40% of the PFD Sensor Input Module Power Supply Controller Standard Output Module Actuator 50% of the PFD Sensor Input Module Monitoring Input Module 43384